cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
asiff
Level 8
Report Inappropriate Content
Message 1 of 8

Value of watchlist are case sensitive ?

Hi All,

Kindly let me know values mentioned in the Watch list are case sensitive ?

7 Replies
arnieos
Level 11
Report Inappropriate Content
Message 2 of 8

Re: Value of watchlist are case sensitive ?

Hi,

I also have the same question.

If anyone can answer this, we would greatly appreciate it.

Thanks.

syed_rizvi
Level 10
Report Inappropriate Content
Message 3 of 8

Re: Value of watchlist are case sensitive ?

Yes, they are.

arnieos
Level 11
Report Inappropriate Content
Message 4 of 8

Re: Value of watchlist are case sensitive ?

Thanks a lot syed_rizvi...

syed_rizvi
Level 10
Report Inappropriate Content
Message 5 of 8

Re: Value of watchlist are case sensitive ?

Your Welcome.  Here are some good examples of creating dynamic watchlists.

McAfee KnowledgeBase - How to filter the SIEM for users ending in a dollar ($) sign

rth67
Level 12
Report Inappropriate Content
Message 6 of 8

Re: Value of watchlist are case sensitive ?

As mentioned by syed_rizvi, they are case Sensitive.

For Displays, Reports, and ELM Searches there are options for Case Insensitive Searches.

However for Correlation Rules and Field Match Alarm logic, there is not an option for Case Insensitive.

I submitted a new "Idea" (PER) on the new Ideas Forum for this, the more people that Vote on it, the higher priority it might receive when being reviewed and presented to Development.

To sign up for the new Ideas forum and begin submitting your Ideas, go to:
https://www51.v1ideas.com/IntelIdeas/ISecGForum

For more information, see KB60021 ( https://kc.mcafee.com/corporate/index?page=content&id=KB60021).

syed_rizvi
Level 10
Report Inappropriate Content
Message 7 of 8

Re: Value of watchlist are case sensitive ?

rth67 wrote:

However for Correlation Rules and Field Match Alarm logic, there is not an option for Case Insensitive.

I submitted a new "Idea" (PER) on the new Ideas Forum for this, the more people that Vote on it, the higher priority it might receive when being reviewed and presented to Development.

To sign up for the new Ideas forum and begin submitting your Ideas, go to:
https://www51.v1ideas.com/IntelIdeas/ISecGForum

For more information, see KB60021 ( https://kc.mcafee.com/corporate/index?page=content&id=KB60021).

Great PER idea

acommons
Level 11
Report Inappropriate Content
Message 8 of 8

Re: Value of watchlist are case sensitive ?

The data type may influence the outcome here.

In the Filters panel you will see the option case insensitive option - Aa - for some, but not all, fields. If that option is present then case sensitivity will be in play, if it is not present, for example on a alphanumeric MAC address or Protocol field, you may have to experiment to be sure.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community